Hardware Router VPN

[EEVblog]

This is how I would do it, you should be able to configure the C1200 to be just a standard AP to bridge wireless clients onto the LAN. You'd need to disable it's DHCP server and assign it a static IP address, that's all. PfSense would take over DHCP duties.

That makes sense, thanks.

[gnif]

Is that router ISP supplied, or one you threw in there?

An old one I threw in there.

Great, it wont be ISP locked down, you can use it for this still.

[EEVblog]

So pfSense should provide me additional network security from disgruntled viewers , as well a VPN capability through a third party service?

[gnif]

And much much more, pfSense is an enterprise level solution, you can do all kinds of magic with it.

[EEVblog]

And much much more, pfSense is an enterprise level solution, you can do all kinds of magic with it.

I'm only a level 1 apprentice magician.

[David Hess]

So pfSense should provide me additional network security from disgruntled viewers , as well a VPN capability through a third party service?

Yes, PFSense will do everything you need.  OPNSense would work also.

Like I wrote earlier, I have not gotten my third party VPN service to terminate at my OPNSense router, but that is just a configuration problem on my side which I have not been able to figure out.  PFSense is more widely used so there is better documentation online.

[EEVblog]

It's not going well...
Also, when installing, do I need the pfsense machine plugged directly into the NBN modem? I assumed so, so connect it to the modem direct.
I got to the install window where it asked me to select the WAN port and gave me the two ethernet port options, but both said "no carrier"

[gnif]

this is just the kernel being noisy, unfortunately it's corrupted the screen a bit. You should still be able to accept the license and proceed without issue.

"no carrier" just means there is nothing plugged into it

[EEVblog]

this is just the kernel being noisy, unfortunately it's corrupted the screen a bit. You should still be able to accept the license and proceed without issue.
"no carrier" just means there is nothing plugged into it

It's plugged into one of the ports the NBN modem though?
The message keeps popping up all the way through the install process

[gnif]

I wouldn't yet be putting it on the NBN modem, just plug it into your switch and don't modify your network. Treat the switch like it's the internet (WAN). Generally you do this and get it all configured and working before altering your working network.

[EEVblog]

It's not seeing the netgate server, even after I reconnected to the LAN switch. Nothing seems to work...

[EEVblog]

It's not seeing the netgate server, even after I reconnected to the LAN switch. Nothing seems to work...

Got it working, somehow switching the ethernet port worked. Install in progress.
I have video of this, of course...

[EEVblog]

Well, that didn't work.
Everyone on X says use OPNsense?

[5U4GB]

Wouldn't that be the same for every router, ever? At some point it's going to get discontinued for support.

Depends on the router.  Draytek support their gear more or less forever, I've received updates for thoroughly obsolete decade-old hardware from them.  TP-Link OTOH never release anything beyond the 1.0 firmware, and then re-release the hardware under the same name but another rev when there's too many problems with the first version.  The Firewalla gear I mentioned is now getting close to its ten-year anniversary and that's still actively supported.

[5U4GB]

Current lab setup.
Everything hangs off the switch in the lab, and a 2nd cascaded switch down in the dungeon which also has another Wifi hotspot and a few devices hanging off it.

Did anyone else look at that and say "Dongeon Switch?  Is that some Korean brand?".

Oh, and now try and unsee it...

[5U4GB]

I have to create a Netgate account to download pfSense? Urgh.

Just use OpnSense, see my earlier post on the two.

[bingo600]

I have to create a Netgate account to download pfSense? Urgh.

Mini intro to pfSense , versions and installer types.
Two or three years ago - Netgate abandoned the "One image fits all" , and decided to make a Plus version that is subscription $$ based.
The "fancy" features like hw accelaration etc. just goes into the plus version now.

They old free version was named CE (Communty edition).
Netgate stated they would still support the CE, but new fancy features for CE had to be community driven.
For home/soho users CE would mostly be adequate.


Plus
Subscription version w. limited intall support - Has more features than the CE (Free) version.
Support some datacenter options (DCO) , and gets updated more frequently than CE.
 
CE - Community Edition
Free , support via forum/friends
Long time between new releases - Almost 2 years between 2.7.2 and the new 2.8.0
AFAIK there has been no major security issues on the CE version , in the two year period between releases. (That couldn't be solved via system_patches)
https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=pfsense&search_type=all&isCpeNameSearch=false

Always install the latest System_Patches package , and install the patches it suggests


Install/Download:
In their (IMHO lack of) Infinite visdom Netgate has switched from a full downloadable install image.
To an "Installer image", that boots up an installer , and requires registration and "online/internet" connection to install the final version.
IMHO that is a BIG mistake.
But Netgate uses this way to  install the PLUS version, and says CE has to follow same way (no extra testing/cost)


Last full image DL
You can download the old "almost current."  2.7.2 CE edition here wo. registration.
https://atxfiles.netgate.com/mirror/downloads/

Always check the validity on any OS downloads , and especially firewall sw.

This is my saved sha256 for the 2.7.2 series for reference

Code: [Select]

2.7.2 sha256 sums

Memstick Serial
bc3ee3d82b8195387114a64c3398505f238a6cb5393ae9b2d45d1bf9408ed192

Memstick VGA
7c68b40c02f06f17146e2f1d5899e2f4a2bcfd98803f06fef8ecf3e2d0f63dcb

ISO
883fb7bc64fe548442ed007911341dd34e178449f8156ad65f7381a02b7cd9e4

You should not even trust my list above, but download both the xxxx.gz and the xxxx.gz.sha256 (sum file)
Now calculate the sha256sum of the downloaded xxxx.gz

MS Win can do it with this built-in program.

Code: [Select]

certutil -hashfile xxxx.gz sha256
Compare the calculated sha256 with the value in the downloaded xxxx.gz.sha256 file.


The "Old full image" downloadable installer, came in 3 flavours (see above).
memstick = usb stick image.

memstick     .... VGA based installer - You have srcreen/kbd attached to pc
memstick  serial   .... serial based installer - You have a serial connection to the box
ISO   ... requires a cd/dvd drive   



pfSense is FreeBSD , and can sometimes be picky w. hw.
Especially "netcards" ... FreeBSD drivers (pfSense) "loves" Intel netcards
Pre 2.6.x - Using realtek was a painfull experience ... Even "don't"


Upgrading pfSense:
pfSense has a nice reputation of being able to import an older configuration , and convert it to current wo. any issues.
That makes it easy to ie. download the 2.7.2 "full image" and upgrade to current 2.8.0 (online)

Downgras is not (officially) supported.
Using a newer config (like from plus), on an older version like (CE) - Is not guaranteed to work.


I'm still considering a switch to OPNsense, would offer same features (maybe even PLUS like features too), and more frequent updates.
But they have previously (i checked two years ago) has some unfortunate updates, that affected stability.
If the quality of the updates has been fixed, i will seriously reconsider...

But for now i have been staying with pfSense CE.

[bingo600]

IMHO pfSense 2.8.0 is still too "fresh off the press"
I'd use 2.7.2 and the "Full installer" (memstick vga) , and wait for 2.8.0 to become 2.8.1 or whatever fix release they make.
Make the bootstick w. BalenaEtcher , or your favourite stick creator sw.


BTW:
You should use ZFS as filesystem, even if just having one drive.
Much more robust (against powerfailures)


And your MOST Important (GUI) command in pfSense is (Backup config):
Diagnostic --> Backup & Restore --> "Download Configuration as XML"
See attached pict.

Once you can fallback to a working config, even the worst crash/FSCK'up is just:
Install pfSense again , restore backup ... Done


Edit:
pfSense vs OPNsense would right now depend on "What type is your best friend" able to help you out with ...

If OPNsense , then go for it.
But as i read responses here, it still seems like you'd get most answers from pfSense users.


Remember the "engine" on the two is much alike ...
But the instrument panel (GUI) is quite different.



Lawrence systems makes some nice pfSense videos on YT

[EEVblog]

So much for OPNsense

[EEVblog]

I'm tempted to just give up, it likely isn't worth my time.
What is the dumbest arse easiest way to get a box between my NBN modem and my switch so that everything on my network goes through a thirty VPN?

[bingo600]

Don't worry so much about the ACPI errors, usually they're minor , and just powersaving related.

Test if your box/login works.

Connect a pc to the "Lan" of the 'sense
do you get a dhcp ip ?
'sense is usually on 192.168.1.1


I can see you have realtek netcards , by the interface re names.
my guess is that re0 is wan , and re1 is lan

[JohanH]

I've never used *BSD, but couldn't you just ignore those ACPI errors and login anyway? The kernel output just hides the command line and the system seems to have booted. Or is it supposed to start a GUI automatically? I think I've seen ACPI errors on Linux a loong time ago (must be 15-20 years ago) when some hardware wasn't fully supported and it still worked just fine.

Edit. Of course, you are supposed to connect with a browser and configure it. You should just have tried that and ignored the console.

[EEVblog]

Don't worry so much about the ACPI errors, usually they're minor , and just powersaving related.
Test if your box/login works.
Connect a pc to the "Lan" of the 'sense
do you get a dhcp ip ?
'sense is usually on 192.168.1.1

Nope, nothing. Same on 192.168.0.124 it said the WAN is on.
Login with both Installer and Root with a bank password don't work.

[EEVblog]

password was opnsense
installing now, I think...

[EEVblog]

Install worked correctly, rebooted, running.
192.168.1.1 it told me to use does not work.
Screw this, I wasted best part of a day on this, I'm out.